Fake ChatGPT and Claude apps spread Yoba malware through GitHub, using signed executables to load a cryptominer on…

Reinach, Switzerland, 4th November 2026, CyberNewswire

Malicious Claude Code extensions targeted Windows and macOS developers through Cursor collecting device details and planting files for persistent remote access.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data.

Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records…

StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…

WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access…

Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…

Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…

Anthropic finds small AI models can set up inference servers across different hardware, raising concerns about future AI…

Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins and blockchain ClickFix…

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.

Over 100 hacked Ukrainian websites used fake Cloudflare checks to install Lunex Stealer and steal browser passwords, tokens and cryptocurrency wallets.

Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes.

Russian group Star Blizzard expands phishing campaigns with a new malware delivery RedFlick technique, using scheduled tasks to deliver the CosmicPulse backdoor.

CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers.